Photo courtesy of author.
In daily life, enterprises of all types rely on automated decisionmaking for a wide variety of situations, such as assessment of eligibility for government benefits, fraud detection, and resources allocation.[1] While automated deciaionmaking may be essential in managing large amounts of data, in some circumstances overreliance on automated decisionmaking, without the interposition of human decisionmaking, can have substantial legal consequences for companies.
On August 21, 2026, the Dutch Autoriteit Persoonsgegevens (AP) (Data Protection Authority), announced that it was imposing a fine of €824,990,000 on the global technology and transportation company Uber. The basis for this fine was the AP’s determination that with respect to its ride-sharing business, Uber made fully automated decisions about whether to suspend drivers’ accounts temporarily or permanently based on suspicions of fraud or customer reviews that were too low.[2]
This post will provide background and a summary of the AP’s action, as well as observations about the ramifications of its decision.
In the European Union, the General Data Protection Regulation (GDPR) does not generally regulate automated decisionmaking, but contains certain specific requirements for the use of automated decisionmaking with legal or other serious consequences.
In particular, the GDPR requires that for those types of decisions, a company may use automated decisionmaking only if it (1) the decision is necessary to enter into or perform a contract with this person; (2) that person has given explicit consent to the decision; and (3) the nation in question has a law in place that says that such automated decisionmaking is permitted (e.g., anti-money laundering laws.)[3]
In addition, even for that type of automated decisionmaking, the GDPR requires that the company must take “appropriate measures” to protect the people concerned. That means a company must enable people to (1) ask the company to have an employee review the decision; (2) let the company know their view on the decision, after which the company can then provide an explanation and take measures, if necessary; and (3) dispute the decision.
Moreover, the AP guidance on these provisions states that it is important that companies (1) can give a transparent explanation about how automated decisions are made and can show that they are in full compliance with the GDPR, and (2) regularly monitor and test the systems that are used for automated decisions, “to ensure that these systems work as intended and do not produce incorrect results.”[4]
The AP investigation of Uber stemmed from reports by 171 French drivers to the French human rights organization Ligue des droits de l’Homme (LDH). LDH then lodged a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL), the French privacy regulator, on behalf of the drivers. Because Uber’s European headquarters are in the Netherlands, pursuant to the “one-stop shop mechanism” in the EU[5] the AP became the lead supervisory authority conducting the investigation but cooperated closely with the CNIL.[6]
The AP found that between 2018 and 2022, Uber “used software to track drivers’ (driving) behaviour and to track customer reviews. If that software detected a suspicion of fraud or customer reviews were too low, the accounts of the drivers concerned were automatically deactivated”, with no human assessment.
In announcing the fine, AP Deputy Chair Monique Verdier stated: “Uber has committed serious infringements. . . . A computer should not make decisions on its own that have major consequences for you.”[7]
The ramifications of the AP fine on Uber extend not only throughout the European Union, but to other countries, including the United States, that are contending with how to regulate the use of automated decisionmaking. Even though Uber has appealed against the fine, other EU Member States are likely to rely on that case in setting their GDPR enforcement priorities and conducting GDPR investigations for similar conduct.
In addition, In the United States, three states (California, Colorado, and Connecticut) have enacted legislation that specifically addresses the use of automated decisionmaking in making employment decisions, and a number of other states have adopted legislation or issued executive orders governing the use of AI in employment decisions by public entities, government agencies, or state departments.[8]
As with other types of artificial intelligence, any automated decisionmaking that uses AI must be subjected to periodic model testing and monitoring to ensure continuing quality, resilience, stability, and sustainable decision making.[9] And as the AP fine against Uber should make clear, even if an automated decisionmaking model appears to have suitably high levels of accuracy, precision, and recall, lawyers and compliance officers need to make sure that if the resulting decisionmaking has legal or other serious consequences, such as employment decisions, humans rather than algorithms are making the ultimate decisions in conformity with relevant laws..
[1] See Open Government Partnership, Automated Decision-Making, Algorithms, and Artificial Intelligence, https://www.opengovpartnership.org/open-gov-guide/digital-governance-automated-decision-making/.
[2] AP, Uber fined nearly 825 million euros for automated driver blocking, August 21, 2026, https://www.autoriteitpersoonsgegevens.nl/en/current/uber-fined-nearly-825-million-euros-for-automated-driver-blocking.
[3] AP, Automated decision, https://www.autoriteitpersoonsgegevens.nl/en/themes/algorithms-ai/algorithms-explained/automated-decision#rules-regarding-automated-decisions-for-companies.
[4] Id.
[5] See AP, How does the one-stop shop mechanism work?, https://www.autoriteitpersoonsgegevens.nl/en/themes/international/one-stop-shop-in-the-eu/how-does-the-one-stop-shop-mechanism-work.
[6] AP, supra note 2.
[7] Id.
[8] Clare Van Prooyen, States Target Artificial Intelligence in Employment Decisions, Ice Miller, October 14, 2026, https://www.jdsupra.com/legalnews/states-target-artificial-intelligence-5500380/.
[9] See PwC, Responsible AI and model testing: what you need to know, https://www.pwc.com/us/en/tech-effect/ai-analytics/responsible-ai-model-testing.html.
Photo courtesy of author.
In daily life, enterprises of all types rely on automated decisionmaking for a wide variety of situations, such as assessment of eligibility for government benefits, fraud detection, and resources allocation.[1] While automated deciaionmaking may be essential in managing large amounts of data, in some circumstances overreliance on automated decisionmaking, without the interposition of human decisionmaking, can have substantial legal consequences for companies.
On August 21, 2026, the Dutch Autoriteit Persoonsgegevens (AP) (Data Protection Authority), announced that it was imposing a fine of €824,990,000 on the global technology and transportation company Uber. The basis for this fine was the AP’s determination that with respect to its ride-sharing business, Uber made fully automated decisions about whether to suspend drivers’ accounts temporarily or permanently based on suspicions of fraud or customer reviews that were too low.[2]
This post will provide background and a summary of the AP’s action, as well as observations about the ramifications of its decision.
In the European Union, the General Data Protection Regulation (GDPR) does not generally regulate automated decisionmaking, but contains certain specific requirements for the use of automated decisionmaking with legal or other serious consequences.
In particular, the GDPR requires that for those types of decisions, a company may use automated decisionmaking only if it (1) the decision is necessary to enter into or perform a contract with this person; (2) that person has given explicit consent to the decision; and (3) the nation in question has a law in place that says that such automated decisionmaking is permitted (e.g., anti-money laundering laws.)[3]
In addition, even for that type of automated decisionmaking, the GDPR requires that the company must take “appropriate measures” to protect the people concerned. That means a company must enable people to (1) ask the company to have an employee review the decision; (2) let the company know their view on the decision, after which the company can then provide an explanation and take measures, if necessary; and (3) dispute the decision.
Moreover, the AP guidance on these provisions states that it is important that companies (1) can give a transparent explanation about how automated decisions are made and can show that they are in full compliance with the GDPR, and (2) regularly monitor and test the systems that are used for automated decisions, “to ensure that these systems work as intended and do not produce incorrect results.”[4]
The AP investigation of Uber stemmed from reports by 171 French drivers to the French human rights organization Ligue des droits de l’Homme (LDH). LDH then lodged a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL), the French privacy regulator, on behalf of the drivers. Because Uber’s European headquarters are in the Netherlands, pursuant to the “one-stop shop mechanism” in the EU[5] the AP became the lead supervisory authority conducting the investigation but cooperated closely with the CNIL.[6]
The AP found that between 2018 and 2022, Uber “used software to track drivers’ (driving) behaviour and to track customer reviews. If that software detected a suspicion of fraud or customer reviews were too low, the accounts of the drivers concerned were automatically deactivated”, with no human assessment.
In announcing the fine, AP Deputy Chair Monique Verdier stated: “Uber has committed serious infringements. . . . A computer should not make decisions on its own that have major consequences for you.”[7]
The ramifications of the AP fine on Uber extend not only throughout the European Union, but to other countries, including the United States, that are contending with how to regulate the use of automated decisionmaking. Even though Uber has appealed against the fine, other EU Member States are likely to rely on that case in setting their GDPR enforcement priorities and conducting GDPR investigations for similar conduct.
In addition, In the United States, three states (California, Colorado, and Connecticut) have enacted legislation that specifically addresses the use of automated decisionmaking in making employment decisions, and a number of other states have adopted legislation or issued executive orders governing the use of AI in employment decisions by public entities, government agencies, or state departments.[8]
As with other types of artificial intelligence, any automated decisionmaking that uses AI must be subjected to periodic model testing and monitoring to ensure continuing quality, resilience, stability, and sustainable decision making.[9] And as the AP fine against Uber should make clear, even if an automated decisionmaking model appears to have suitably high levels of accuracy, precision, and recall, lawyers and compliance officers need to make sure that if the resulting decisionmaking has legal or other serious consequences, such as employment decisions, humans rather than algorithms are making the ultimate decisions in conformity with relevant laws..
[1] See Open Government Partnership, Automated Decision-Making, Algorithms, and Artificial Intelligence, https://www.opengovpartnership.org/open-gov-guide/digital-governance-automated-decision-making/.
[2] AP, Uber fined nearly 825 million euros for automated driver blocking, August 21, 2026, https://www.autoriteitpersoonsgegevens.nl/en/current/uber-fined-nearly-825-million-euros-for-automated-driver-blocking.
[3] AP, Automated decision, https://www.autoriteitpersoonsgegevens.nl/en/themes/algorithms-ai/algorithms-explained/automated-decision#rules-regarding-automated-decisions-for-companies.
[4] Id.
[5] See AP, How does the one-stop shop mechanism work?, https://www.autoriteitpersoonsgegevens.nl/en/themes/international/one-stop-shop-in-the-eu/how-does-the-one-stop-shop-mechanism-work.
[6] AP, supra note 2.
[7] Id.
[8] Clare Van Prooyen, States Target Artificial Intelligence in Employment Decisions, Ice Miller, October 14, 2026, https://www.jdsupra.com/legalnews/states-target-artificial-intelligence-5500380/.
[9] See PwC, Responsible AI and model testing: what you need to know, https://www.pwc.com/us/en/tech-effect/ai-analytics/responsible-ai-model-testing.html.
